Parameters

Console reference for parameters: the key list, setting values, version history, the Schema card, comparing environments, CLI equivalents, and required permissions.

Path: Projects > (project) > (environment)

The console calls each key in your environment a parameter. We never show a value in a list.

Key list

Column	Content
Name	The key's address, linking to its detail page. After it: the type, a crossed-out eye when sealed, an amber `*` when required, a padlock when the key cannot be renamed or overwritten here. Read-only
Value	Masked, with Reveal. Write-only in a write-only environment. Generated on demand for a key that mints on demand. Can't Decrypt when we cannot open the current version
Updated	Current version and time since it was written. No version for a key that mints on demand (we store nothing)
Rotation chip	Under the version when the key carries `@rotate`: Rotates every 90d (fresh), Due in 3d (last week of the interval), Overdue 12d (interval passed)

The search box sits at the top, then the sort, then Due for rotation, which keeps only due and overdue rows. Rows group by path. The pin on a row keeps it at the top in this browser only.

Header buttons: New Dynamic Parameter (Dynamic engines), Set Parameter, and the environment menu, which holds Compare.

We mark a value Can't Decrypt when we cannot open it:

Case	Detail
When shown	Before you reveal it, when your own key (BYOK) sealed its current version and you revoked or abandoned that key. On reveal, for any other key failure
What the row offers	No new value and no rename: the value still exists

With secret:write the list is also the editor. The pencil opens a new value for the row, Rename in the row menu opens its name, and Add Parameter adds a row.

Changes stack up; Save Changes (or ⌘S) saves them together in one write, and Discard drops them. A rename or a removal asks you to confirm first.

Set Parameter takes rows three ways: you type them, paste a .env for the console to split, or drop a .env file anywhere on the page. Choose a file picks one instead; Add a row adds an empty one. We parse the file in your browser and never upload it.

Form element	Behaviour
Path	Prefixes every row, for example `aws/prod`; a name like `s3/BUCKET` nests under it
Row status	New key, or new version of an existing key
Type (new rows)	Mirrors `@type`
Sensitive	All rows; mirrors `@defaultSensitive`
Existing row	Keeps the declaration `penv push` sent

There is no edit in place. Every write appends a version, and we reply with the version number we assigned. Set New Version on a key opens the form with ?rotate=1 plus a path and name, which locks the address and names the exact version it creates.

Key detail

Open a key to see its current version, when and by whom it was last set, how many versions it has, and when it was first set.

Reveal opens the current value and the version before it opens the previous one (Grace Window); older versions are not revealable. We ask for step-up and audit each as a separate read.

When we cannot decrypt a value, we report it as undecryptable, never as missing. Overwriting it replaces a secret that still exists. See Encryption in the cloud.

Schema card

The Schema card beside the current value holds the decorators penv push sent. Save Schema records secret.schema with the changed fields; we touch no value, so we ask for no step-up. Decorator reference: Schema format.

Your committed .env.schema wins: the next penv push overwrites console schema edits. Fix the file as well.

Field	Rule
Sensitive	One-way. Once sealed, `must_encrypt` cannot be turned off; a key that should stop being secret needs a new key with a public name
Rotate every	Due date is the current version's date plus the interval (Next rotation on the card, chip on the list). We list overdue keys in a weekly email to the members chosen for security alerts. We do not rotate a value automatically

Compare environments

Path: (environment) > ⋯ > Compare

Lists every name in either environment with each side's version, date and declared type. Compare with picks the second environment; it offers only environments you can read.

We compare versions and declared types, never values. Each side keeps its own Reveal, audited like any other.

Mark	Meaning
Amber rule, amber version	Both sides hold the key at different versions
Amber type tag	Both sides declare a type and the types differ
Grey rule, Missing	Only one side holds the key

The counts above the table total each kind. A side we cannot decrypt shows Can't Decrypt, never Missing.

CLI equivalents

Console action	Command
Open the key list	`penv ls`
Set a value or a new version	`penv set`
Push a `.env` and its schema	`penv push`
Reveal the current value	`penv reveal`
Delete a key	`penv unset`

Required permissions

Full matrix: Roles and permissions. All permissions apply at the environment. Step-up rules: Security and two-factor.

Action	Permission	Step-up	Audit entry
Open the key list	`secret:read`	No	none
Set a value	`secret:write`	Yes	`secret.write`
Edit the schema	`secret:write`	No	`secret.schema`
Paste or drop a `.env`	`secret:write`	Yes	one `secret.write` per key
Reveal the current value	`secret:reveal`	Yes	`secret.read`
Reveal a previous version	`secret:reveal`	Yes	`secret.read.previous`
Delete a key	`secret:delete`	Yes	`secret.delete`
Export values to a file	`secret:reveal`	Two-factor and fresh	`secret.export`

secret:reveal is separate from secret:read; a Viewer sees that a key exists but cannot open it.

Deleting removes the key from your list. We keep its version rows, because history is append-only.

Next: Machine identities.